1 



INTERNATIONAL PATENT OFFICE 
WORLD ORGANIZATION FOR INTELLECTUAL PROPERTY 
International patent published on the basis of the Patent Cooperation Treaty 
INTERNATIONAL PUBLICATION NO. WO 94/18036 Al 



International Patent Classification. 5 : 

International Filing No.: 

International Filing Date: 

International Publication Date: 

Priority 

Date: 

Country: 

No.: 

Designated States: 



B 60 R 25/00 
25/10 
E 05 B 49/00 

PCT/DE94/00147 

February 11, 1994 

August 18, 1994 



February 12, 1993 
AU 

PL 7276 



AU, CM, CZ, HU, JP, KR, PL, RU, 
US, European Patent (AT, BE, CH, 
DE, DK, ES, FR, GB, GR, IE, IT, 
LU, MC, NL, PT, SE) 



REMOTE-CONTROLLED PROTECTION SYSTEM FOR A MOTOR VEHICLE 



Inventors; and 

Inventor/Applicants (only for the USA): 



Philip Rodney Linton [AU/AU] 
45 Kanooka Road, Wantirna South, 
VIC 3152 (AU) 

Janis Eglinsch-Veglinsch [AU/AU]; 
26 The Boulevard, Ivanhoe, VIC 
3079 (AU) 

Wolfgang Matuschek [DE/AU]; 12 
Manhatten Court, Patterson Lakes, 
VIC 3197 (AU). 



Published 

With international Search Report 



2 



Abstract 



10 20 



System for coniadlew protec- 
tion of & vehlcte. Said system god- 
dst* of a remote-control key (8) for 
generating and ttmsmfctitag an un* 
loeki&g aignal (P, JO as well a* a sys- 
tem ancanged m &e vehicle (4> <S) ft» 
itcci ving and processing the unlock- 
ing signal, Accotding to the inven- 
tion* tb« unlocking signal (F, R) U 
changed each time tbe remote con- 
trol key (6) is actuated. 
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The invention starts from a device in accordance with the class of the main claim. 

In order to secure motor vehicles against unauthorized usage, the use of securing devices 
is known that only allow the vehicle to be started if a code signal produced by a startup device 
agrees with a reference code signal present in the vehicle. Known devices generally comprise the 
locking devices of vehicle doors as well as control devices for controlling the operation of 
vehicle components essential for operation such as the starter, gas pump or the injection system 
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of the central engine control device. A starting of a vehicle secured in this manner is not even 
possible if a non-authorized person has gained access to the vehicle cab and has short-circuited 
the ignition. The security device is typically actuated with the aid of a remote control that 
generates, e.g., coded high-frequency or infrared signals. 

A weak point of these known devices is the fact that they can be circumvented by an 
unauthorized recording of the code signal transmitted between the vehicle key and the vehicle. 
Once recorded, the control signals can be reproduced in any manner, thus allowing an 
unauthorized user to operate the vehicle. 

The invention has the problem of indicating a remote control security device that avoids 
an unauthorized starting of a vehicle by a simple recording and reproduction of an unlocking 
signal. 

This problem is solved by a device with the characterizing features of the main claim. In 
a security device in accordance with the invention the unlocking code transmitted between the 
remote control key and the vehicle is changed for each actuation of the security device. The 
change takes place in the remote control key and, in the same manner, in the receiving device 
arranged in the vehicle. The advantage of the continual changing of the unlocking code is that an 
unlocking of the vehicle with the aid of a code recorded during a previous unlocking action is not 
possible. A recorded code would be identical to the one used during the last previous unlocking 
action but the receiving device arranged in the vehicle would always expect a code that had been 
changed from the previous one. It would therefore not react to a repeated use of the same code. 

Advantageous further developments and advantageous embodiments of the security 
device of the invention result from the dependent claims. 

It proved to be advantageous regarding the simple realization achieved in this manner to 
generate the actual unlocking code by linking an unchangeable fixed code and a rolling code that 
changes upon each actuation. The linking takes place in a logical linking unit in accordance with 
a given logical rule. 

In order to make it possible for an authorized user to operate the vehicle even when the 
remote control was inadvertently actuated without an unlocking of the vehicle having taken 
place, it is advantageous to design the evaluation unit that receives the unlocking code in such a 
manner that that it allows an unlocking even if the received code differs from the expected one 
by a given number of actuations. The number of actuation events by which the unlocking code 
emitted by the remote control and the unlocking code expected by the evaluation unit may differ 
is advantageously in the range of 100 to 500, preferably 250. 

An exemplary embodiment of the invention is described in detail in the following with 
reference made to the drawings. 
Drawings 
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Figure 1 shows a basic circuit diagram of the suggested security device. Figure 2 shows a 
block diagram of a transmitting and receiving device. Figure 3 shows a flowchart of the code 
testing process. 

Basic elements of the suggested security device are, as shown in Figure 1, remote control 
8 in the form of a remote-control key as well as evaluation unit 4 arranged in the vehicle to be 
secured, which unit receives signals emitted from remote-control key 8 via antenna 6. Key 8 is 
composed of grip housing 10 and key blade 12 projecting from it. However, the latter can also be 
missing or realized in a separate key. Signal generating device 14 for generating an unlocking 
signal and antenna 38 for transmitting the generated signals are located in grip housing 10, 
designated in the following simply as the housing. Furthermore, switch 20, e.g. in the form of a 
pushbutton, is arranged on a top side of housing 10 by means of which signal generating device 
14 located in the housing can be actuated in order to generate signals for actuating and 
deactuating the security device. Evaluation unit 4 arranged in the vehicle to be secured is 
connected on its output side to door locking device 24 as well as to other devices basic for the 
operation of the vehicle, e.g., to starter 26 and/or gas pump 28 and/or injection system 30. Of 
course, even other or further vehicle devices can be connected to the evaluation unit. The 
arrangement shown in Figure 1 is known and will therefore not be described in detail. 

Figure 3 [sic; 2] shows the operating principle of the security device of the invention. In 
order to generate an unlocking code, signal generation device 14 arranged in housing 10 of key 8 
comprises device 32 for generating a fixed code, device 34 for generating a rolling code and 
encoding device 36. Device 32 for generating a fixed code is a memory in the simplest instance. 
The fixed code can be, e.g., a 16-bit binary code associated individually with each individual 
vehicle. Generation device 34 comprises a circuit for generating a rolling code that can also be a 
16-bit binary code. However, in distinction to the fixed code, it changes at each actuation of 
switch 20. In an especially simple embodiment this change can consist in that the value of the 
rolling code is increased by the value 1 upon each actuation of the switch. 

The output signals of code generation devices 32, 34 are supplied to encoding unit 36. It 
generates an encoded unlocking signal by linking received fixed code F and received rolling 
code R. The encoding takes place in such a manner that it is not possible to recognize in a simple 
manner the changing rule forming the base for the rolling code generated in unit 34 from the 
unlocking code. This is achieved in particular by a suitable logical linking of the signals, 
preferably by an AND or an EXOR linking or a combination of these logical linkings with 
arithmetic or logical operations. The output signal of encoding device 36 is supplied to a 
transmission device (not shown) that emits it via antenna 38 arranged in housing 10. 



5 



The encoded unlocking signal is received on the vehicle by antenna 6 and supplied to 
decoding device 40, which is part of evaluation unit 4. It is designed to undo the encoding action 
in coordination with encoding device 36. Accordingly, decoding device 40 regenerates fixed 
code F and rolling code R from the received unlocking signal. Via lines 42, 44 it supplies the 
former to device 46 for checking the fixed code and the second to device 48 for checking the 
rolling code. All elements 42 to 48 are also components of evaluation unit 4. In order for security 
device to release the vehicle operation, fixed code F as well as rolling code R must be found to 
be in order. To this end checking device 46 checks whether fixed code F supplied from decoding 
device 40 agrees with a reference fixed code F present in evaluation device 4, e.g. in memory 45. 
If this is the case, it emits a permission signal for carrying out the following logical operations. 

In order to check the correctness of rolling code R obtained from decoding device 40, 
check device 48 checks whether the received rolling code differs in a predetermined manner 
from the rolling code R received during the last admissible unlocking, that was filed to this end, 
e.g., in memory 47. In an especially simple embodiment of the security device of the invention, 
this check consists in examining whether the difference between the currently received rolling 
code R and the R N that was the last one used before it has the value one. If the result of the 
check is positive, check device 48 generates a permission signal in order to bring about the 
further logical operations for releasing the operation of the vehicle. If both check devices 46, 48 
have emitted a permission signal, evaluation unit 4 interprets the received unlocking signal as a 
signal generated by an authorized user and unlocks the security device. If, on the other hand, one 
or both of the signals emitted by check devices 46, 48 is/are not a permission signal, evaluation 
unit 4 interprets the received unlocking signal as an unauthorized signal and retains the vehicle 
locking. An unlocking of the vehicle is thus in particular not possible with a simple copy of the 
signal used during the previous unlocking. 

There is the possibility that switch 20 is actuated when key 8 is not even in the vicinity of 
the vehicle. This can happen, for example, if a child is playing with key 8 in an unforeseen 
manner and actuates switch 20. As a consequence thereof, it can happen that the rolling code R 
generated by generation device 34 is no longer the code directly following code Rn present in 
check device 48, or in other words: generation device 34 and check device 48 are 
desynchronized. In order to make it nevertheless possible to start a vehicle by an authorized 
person in such cases, it is advantageous during the check by check device 48 to also find such 
rolling codes R in order that differ from the code Rn present in evaluation device 4 by not more 
than a given amount K regarding their formation sequence. It proved to be advantageous in 
practice to set this amount K at a value between 100 and 500, preferably at 250. 

It is possible, in spite of allowing a certain desynchronization between the code generated 
in key 8 and the rolling code expected by evaluation unit 4, that the two codes deviate from 
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another by more that the permitted extent, that allows, e.g., a desynchronization of up to K = 250 
formation steps. Such an instance can occur, e.g., as a consequence of a failure of the voltage 
supply of generation device 14 in key 8 or evaluation unit 4. 

A preferred embodiment of the invention therefore provides the possibility of a new 
synchronization between the code generated in generation device 14 and the rolling code 
expected by evaluation unit 4. According to the invention, in the case of a desynchronization, a 
new synchronization is achieved in that switch 20 arranged on key 8 is actuated a set number of 
times within a set time period. It is provided in the exemplary embodiment that switch 20 is to be 
actuated five times within a period of 10 seconds for a new synchronization. At this time the 
check of fixed code F by check device 46 takes place in unchanged form. Rolling code R is also 
updated in unchanged form upon each actuation of switch 20 in accordance with the set 
formation rule, in the simplest case by being incremented by one. 

Figure 3 shows a flow chart of the code check in evaluation unit 4. After decoding of the 
received unlocking signal in decoding device 40 in step 58, evaluation unit 4 first checks in step 
59 whether fixed code F transmitted with the unlocking signal is in order. If this is not the case, it 
waits for the next received signal F, R and no unlocking takes place. If the result of the fixed 
code check in step 59 is positive, the check takes place in step 60 whether received rolling code 
component R of the unlocking signal is in the area between rolling code R N used during the last 
unlocking and rolling code Rn+k with the ordinal number N + K. If the rolling codes can be 
considered as numbers corresponding to their ordinal number, this check is represented as 
follows: R N < R < Rn + K? If the rolling code is in the area [N, N + K] predefined in this 
manner, the evaluation unit replaces rolling code Rn from the last unlocking in step 74 with the 
current rolling code R and deactivates the security device. If the check in step 60 shows that 
rolling code R is not in the predefined range, there is a desynchronization. Evaluation unit 4 then 
checks in step 62 whether rolling code R is the one following internal code Rj filed in an 
intermediate memory as regards its ordinal number. If codes R, R, can be represented as ordinal 
numbers, step 62 corresponds to the check of whether codes R and Rj differ by the value of one. 
If the difference does not correspond to the value of one, which is generally the case at first 
given the presence of a desynchronization, internal rolling code Ri, which was at first any 
arbitrary code filed in the intermediate memory 49, is replaced by the current rolling code R not 
in synchronization in step 64. A release of the vehicle operation does not take place. 

Following step 64, evaluation unit 4 awaits the reception of the next unlocking signal F, 
R. The rolling code contained in it is again necessarily outside the admissible range checked in 
step 60 if a desynchronization is present, for which reason step 62 is automatically carried out. 
After value Rj present in the intermediate memory has been replaced by value R during the check 
of the previous unlocking signal, the condition checked in step 62 is now met. Therefore, in the 
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next step 66 the state of a meter Z is increased by 1 . The obtained meter state Z is then checked 
in following step 68 to see whether it has reached a predetermined value P, e.g., value 5. If this is 
not the case, the content of intermediate memory 49 is again replaced in step 64 by the current 
rolling code R. Subsequently, evaluation unit 4 again awaits the input of the next unlocking 
signal F, R. Steps 59, 60, 62, 66, 68, 64 are repeated until the state of the meter has reached set 
value P checked in step 68. If this value is, e.g., five, an unlocking signal F, R must be sent to 
evaluation unit 4 a total of six times for a new synchronization. Finally, if the result of the check 
in step 68 is positive, the value of rolling code Rn present from the last unlocking action is 
replaced in step 72, analogously to step 74, by the value of current rolling code R and the 
security device is deactuated. In order for the new synchronization to be successful, the repeated 
sending of an unlocking signal to increase the meter in step 66 to the set value must take place 
within a set time period. If the set value is five, this time period can be, e.g., 10 seconds. It is 
realized in the exemplary embodiment by time meter 70 that monitors the rise in counting in step 
66. If the meter does not receive the number of counting commands necessary for attaining the 
value tested in step 68 within the set time, the time meter is reset. The new synchronization must 
then be restarted. 

After the determination of the input of a correct unlocking signal in step 74 or 72 with 
subsequent release of the vehicle operation, the evaluation unit goes into a waiting position and 
awaits the input of new unlocking code signals F, R. 

Signal generation device 14 arranged in key 8 as well as evaluation unit 4 located in the 
vehicle can be designed by discrete components as well as advantageously in the form of a 
device processing digital signals such as, e.g., a microprocessor or an ASIC. 

A plurality of variations of the exemplary embodiment presented can be found while 
retaining the concept of the invention of continuously changing the unlocking signal, allowing 
that the unlocking code transmitted with the unlocking signal and a reference code differ from 
one another in a set frame and additionally providing the possibility of a^new synchronization. 
This applies in particular to the design of the signal generation device in the key and of the 
evaluation unit in the vehicle and also, e.g., for the manner of linking the fixed and the rolling 
code in encoding device 36. 

Claims 

1. A device for the contactless securing of a vehicle with a device (14) for generating an 
unlocking signal that contains switching means (20) for triggering the operation of the signal 
generation device and means (36, 38) for emitting the unlocking signal in encoded form and with 
a device (6, 4) for receiving and evaluating the unlocking signal, characterized in that the signal 



generation device (14) comprises means (32, 34, 36) for changing the unlocking signal at each 
successive actuation of the switching means (20). 

2. The device according to Claim 1, characterized in that the means for changing the 
unlocking signal comprises means (32) for generating a fixed code (F), means for generating a 
rolling code (R) that changes upon each actuation of the switching means (20), and means (36) 
for linking the fixed code (5) to the rolling code (R) in accordance with a set rule. 

3. The device according to Claim 1, characterized in that the evaluation unit (4) 
comprises a check device (48) that checks whether a rolling code (R) is greater relative to an 
ordinal number updated at each actuation of the switching means (20) than the rolling code (R N ) 
used in the last successful deactivation of the security device. 

4. The device according to Claim 3, characterized in that the check device (48) checks 
whether a rolling code (R) is smaller relative to an ordinal number updated at each actuation of 
the switching means (20) than the number that results by adding a set value (K) to the cardinal 
number (N) of the rolling code (R N ) used in the last successful unlocking. 

5. The device according to one of the previous claims, characterized in that means are 
provided for making possible a new synchronization between a received code and a rolling code 
(R) expected by the evaluation unit (4). 

6. The device according to Claim 5, characterized in that the means for the new 
synchronization comprises a memory (47) for storing the last rolling code (R N ), a comparison 
device (62) for comparing the last rolling code (R N ) with the current rolling code (R), and a 
time-controlled counting device (66, 68, 70) that deactivates the security device if a set number 
of successive rolling codes (R) goes to the comparison device (62) within a set time. 
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